func (s *DefaultConsentStrategy) ValidateResponse(a fosite.AuthorizeRequester, token string) (claims *Session, err error) {
t, err := jwt.Parse(token, func(t *jwt.Token) (interface{}, error) {
if _, ok := t.Method.(*jwt.SigningMethodRSA); !ok {
return nil, errors.Errorf("Unexpected signing method: %v", t.Header["alg"])
}
pk, err := s.KeyManager.GetKey(ConsentEndpointKey, "public")
if err != nil {
return nil, err
}
rsaKey, ok := jwk.First(pk.Keys).Key.(*rsa.PublicKey)
if !ok {
return nil, errors.New("Could not convert to RSA Private Key")
}
return rsaKey, nil
})
if err != nil {
return nil, errors.Errorf("Couldn't parse token: %v", err)
} else if !t.Valid {
return nil, errors.Errorf("Token is invalid")
}
if time.Now().After(ejwt.ToTime(t.Claims["exp"])) {
return nil, errors.Errorf("Token expired")
}
if ejwt.ToString(t.Claims["aud"]) != a.GetClient().GetID() {
return nil, errors.Errorf("Audience mismatch")
}
subject := ejwt.ToString(t.Claims["sub"])
for _, scope := range toStringSlice(t.Claims["scp"]) {
a.GrantScope(scope)
}
return &Session{
Subject: subject,
DefaultSession: &strategy.DefaultSession{
Claims: &ejwt.IDTokenClaims{
Audience: a.GetClient().GetID(),
Subject: subject,
Issuer: s.Issuer,
IssuedAt: time.Now(),
ExpiresAt: time.Now(),
Extra: t.Claims,
},
Headers: &ejwt.Headers{},
},
}, err
}
